The Cloud Entitlements Policy Management feature allows organizations to establish, monitor, and identify discrepancies in persistent, temporary (Just-in-Time), and Segregation of Duties (SoD) entitlement policies. This capability promotes consistent least privilege practices, strengthens security, and facilitates ongoing compliance within multi-cloud infrastructures.
Use cases
Defining entitlement policies
Administrators can create granular entitlement policies through a dedicated interface, scoping them to specific Cloud Service Providers (CSPs) and accounts:
- Static entitlement policies: Define persistent access rules based on identity attributes (e.g., group membership, tags) and conditions, specifying allowed or denied static entitlements.
- Dynamic entitlement policies (JIT): Define temporary, conditional access rules. This involves configuring triggers (events initiating access requests), conditions for granting access (such as approvals or justifications), and parameters such as maximum duration, specific roles or permissions, and scope for JIT sessions.
- Segregation of Duties (SoD) policies: Formulated to prevent toxic combinations of cloud entitlements. Administrators can define mutually exclusive permissions or roles to ensure that no single identity possesses conflicting access rights that could lead to malicious actions, unauthorized data exfiltration, or compliance violations (e.g., the ability to modify infrastructure alongside the ability to delete audit logs).
Tracking and monitoring entitlement policies
Cloud Entitlements offers continuous monitoring of cloud environments, comparing actual entitlement states with defined policies. The monitoring scope encompasses current static role assignments, policy attachments, group memberships, active dynamic (JIT) sessions (including their duration and granting conditions), and continuous evaluation of identity permissions against established SoD conflict matrices.
Reporting and auditing provides dashboards and reports on policy compliance, active JIT sessions, detected drift, and identified SoD violations. Comprehensive audit trails are maintained for policy changes, entitlement assignments, and JIT lifecycle events.
Drift detection and response
Cloud Entitlements proactively identifies "drift", which occurs when actual cloud entitlements deviate from established policies. The drift detection and response process includes:
- Detection: Identifies drift for static policies (e.g., a user receiving a forbidden permanent role), dynamic policies (e.g., a JIT session exceeding its approved duration or being granted without proper conditions), and SoD policies (e.g., an identity accumulating conflicting permissions that result in a high-risk access combination).
- Alerting and notifications: Upon detecting drift or an SoD violation, Cloud Entitlements generates immediate alerts, deliverable via email, Slack, and SIEM integration (Syslog), providing deep context on the policy violation.
- Automated and assisted response: Administrators can configure automated responses, such as blocking an attempted non-compliant static assignment, automatically revoking an overdue JIT session, or immediately suspending access when a toxic combination of SoD entitlements is detected.
Following detection, alerting, and response, the platform provides relevant context to facilitate prompt manual investigation and resolution of any detected drift.
Benefits
- Enhanced security: Proactively mitigates risks from excessive permissions, misconfigurations, and toxic access combinations.
- Continuous compliance: Automated monitoring ensures ongoing adherence to internal governance frameworks and external regulatory mandates (e.g., SOX, SOC2, PCI-DSS).
- Operational efficiency: Streamlines entitlement audits and JIT access management through policy automation and centralized visibility.
- Reduced attack surface: Enforces least privilege consistently for both static and dynamic access across the cloud estate.